Cleartext Credential Exposure in Dropbox Desktop Application

CVE-2019-12171

What is CVE-2019-12171?

The Dropbox desktop application version 71.4.108.0 contains a vulnerability where cleartext credentials are stored in memory after user login or account creation. This sensitive information is inadequately handled, leading to potential unauthorized access. The issue arises in Dropbox.exe and the Web Helper component, QtWebEngineProcess.exe, where critical user data remains exposed throughout the application's lifecycle. This flaw highlights the importance of secure memory management to prevent data leaks.

References